Provantix
Get access

Security & trust

A product that sells proof has to be provable itself. Isolation, credential hygiene and honest evidence handling are the architecture, not a compliance slide.

Per-organization databases

Every customer gets a dedicated Postgres database with pgvector, physically separate from every other customer. No shared schema, no row-level filtering as a security boundary. Offboarding is a process, not a button: export, grace period, legal-hold check, then deletion, with a deletion certificate at the end.

Secrets that aren't stored

Org admin tokens are derived from a platform secret, never persisted. Session tokens are stored as hashes only. Emitter keys can be rotated per organization without touching any other customer.

Google Workspace SSO

Sign in with Google OAuth, with hosted-domain restriction rolling out: accepted accounts limited to your Workspace domain, so consumer Gmail accounts are never accepted for a restricted organization. Disabling password sign-in per organization is on the roadmap.

Invite-only onboarding

Early access is provisioned by invitation, no open registration. Team invitations are single-use, expiring, and attempt-limited. The same controls carry into the product as multi-user teams land.

Your data residency

Each organization's data lives in its own dedicated database, isolated from every other customer, with nothing telemetry-related on worker disks beyond transient processing. Region selection and dedicated deployments for data-residency requirements are on the enterprise roadmap; writing exports and backups to customer-controlled storage buckets is on the same track.

Gaps reported, never hidden

The custody chain makes missing telemetry visible by design. An interrupted stream becomes an explicit finding in exports, the platform never silently smooths over absent evidence.

No trust required

Verify the evidence without verifying us

Every protection below is checkable by the recipient of an export, not just asserted by us. An auditor with the bundle and our open verification steps needs nothing from Provantix to reach a conclusion.

  1. 1
    Re-hash the bundle
    Re-compute the custody hash of every event and compare it against the manifest. Any alteration after capture changes the hash.
  2. 2
    Verify the hash chain
    Every record's hash chains to the previous one per agent and per session, and the export manifest carries the chain heads. A record altered after capture breaks the chain. Batch signatures are verified at ingest, before storage, so a batch we modified would have been rejected on arrival.
  3. 3
    Confirm the gaps
    Sequence gaps in the chain are listed explicitly in the export. Missing evidence is reported as missing, so a clean-looking bundle can't hide a silent outage.
Framework mapping

Evidence designed for the frameworks your auditors use

Provantix produces the evidence these frameworks ask for; your auditor makes the attestation. We claim no certification we don't hold; SOC 2 Type II is planned and listed below with everything else still open.

SOC 2

Change-management and monitoring evidence (CC7, CC8): attributable change records, custody chains, and gap reporting for every automated action.

ISO 27001

Audit-logging and access-control support (A.8.15, A.5/A.8 access review): who authorized what, under which credential, retrievable on demand.

NIST AI RMF

Govern and Map functions: a living agent inventory with owners and mandates, and identity-bound records for AI-driven actions.

EU AI Act

Article 12 record-keeping for high-risk AI systems: automatic, tamper-evident event logs with retention and export controls.

Assurance roadmap

What we're certifying, in order

We run the same discipline on ourselves that the product enforces on your agents: explicit commitments, verifiable progress, no vague "enterprise-ready" labels.

  • SOC 2 Type II audit
  • Per-tenant encryption keys (enterprise)
  • EU data residency option
  • SCIM provisioning & role-based access
  • Customer-managed KMS for evidence bundles
  • Python SDK
  • PDF export, with findings & agent records inside the bundle
  • Full-text search (semantic search ships first)
  • Customer-controlled storage buckets for exports & backups
  • Per-organization option to disable password sign-in
  • Change-window findings, once a change-calendar source exists

What the evidence proves, and what it doesn't

We would rather state the limit of the claim than have an auditor find it first.

What is proven

  • · A record was not altered, reordered or removed after the SDK or collector signed it; tampering breaks the chain and is rejected
  • · Gaps in the sequence are detected and reported as findings, not smoothed over
  • · Every record carries an attribution method and a confidence score. Records that cannot be linked to an agent are kept, not dropped, and are listed for review. Confidence reflects the evidence: a dedicated credential is treated as certain, while a shared credential or a timing-based match is lower and is labelled as such. Approval evidence appears only where the emitter sent it

What is not proven

  • · That an agent reported every action it took. A signed record proves what was sent, not that nothing was omitted
  • · Closing that gap needs a second, independent vantage: the destination system's audit log, or the identity provider's
  • · That is exactly what the Microsoft connectors add today, and what AWS, GCP and Kubernetes connectors will add next

Content stance and app hardening

What we capture, what we never do, and the controls on every app response — written down so your security review doesn't have to ask.

Content stance

  • · Prompts and completions are stored hash-only — provable matches without the content
  • · Tool arguments and results ship as redacted, truncated, erasable summaries — erasable on request, with erasure itself recorded
  • · Emitter keys sign at the edge and never travel with telemetry
  • · Full statement: docs → Content stance

On every app response

  • · Enforced Content-Security-Policy (no inline scripts) and X-Frame-Options: DENY
  • · X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, HSTS
  • · Fonts self-hosted — no third-party origin sees your page views
  • · API and share-link responses marked no-store; hashed assets immutable

Don't take our word for it. Recompute it.

Every evidence export verifies offline — in the browser, with no account. Hashes, chain links and the daily root recompute from the files alone, and a tampered byte fails with the first failing record named.

Verify an export

How the checks work: docs → How verification works

Security review? Bring your toughest questions.

We walk every early-access customer through the architecture, the isolation model and the evidence chain before the first event is streamed.

Your agents are already acting.
Start proving who authorized them.

Early-access organizations get a dedicated database, identity connectors, and a guided import of their existing traces.

Invite-only during early access. Google Workspace SSO supported from day one.